You.
The witness is going to take your seats we're waiting for the gentleman from Texas
the ranking member he's expected presently
and as soon as he comes in we'll get started.
She cares.
The
two.
Subcommittee will now come to order I'm pleased to welcome you today to the hearing
before the Subcommittee on Crime Terrorism and Homeland Security on H.R.
Forty one seventy five.
The privacy and cyber crime Enforcement Act of two thousand and seven.
I'd like to thank the chairman of the full committee Mr Conyers for introducing the
bill with bipartisan support.
They bill was introduced by the right by the chairman
and ranking member of the committee and the subcommittee
and I'm pleased to have been working with Mr Conyers
and drafting it to provide effective tools for federal prosecutors and state
and local law enforcement agencies to combat an O.T. Theft and other cyber crimes.
The Act takes several important steps to protect American consumers from the
dangers of an anything after first our bill provides for the victims of identity
theft.
Provide them with the ability to seek restitution in federal court for the loss of
time and money spent restoring their credit.
Under current law restitution to victims is only available to recover the direct
financial cost of identity theft offenses such as recovering funds from authorized
credit credit cards charges.
But many identity theft victims incur other indirect costs such as loss of wages
due to time taken off from work to resolve credit disputes Bill I'm in the present
law to make it clear
that restitution orders may include an amount equal to the value of the victim's
time spent addressing the actual or intended harm. Of the identity theft.
And the bill addresses the urgent need for agencies.
And companies to provide appropriate notification
when they experience major breaches the problems of data breaches remain persistent
and dangerous threat to Americans privacy for example in two thousand
and six there was a disclosure
that a company had suffered a major computer breach involving up to forty five
million credit card credit and debit card records.
The company knew about the breach.
None of its customers were told about it until a month later
and we're all aware of the identity theft.
From twenty six million of our veterans
and active duty personnel from the Department of Veterans Affairs last year.
Although up to thirty nine states have laws pertaining to data breaches there's no
federal standard or regulation to provide notice.
Bill require rapid notice of reaches the F.B.I.
and Secret Service and this notice is critical to the excess will investigation
and prosecution of any criminal activity associated with the breach the F.B.I.
And so
that Secret Service would then publish the list of reported breaches in the federal
register so that the public will be aware of where
and to what extent major data breaches are occurring.
Only the bill makes it a crime punishable by up to five years in prison for
knowingly to fail to report major breaches to the appropriate authorities.
Lastly this bill provides such much needed tools to federal
and state law enforcement agents the bill add section ten thirty two the.
Computer Fraud and Abuse Act. And Section ten thirty.
The computer fraud abuse act to the RICO statute which will provide the Department
of Justice with much with a much needed tool to investigate
and prosecute organized crime syndicates which used to Fisk gaited cyber crime
cyber schemes to commit criminal acts will also also authorize us twenty five
million dollars each of the fiscal years from two thousand
and eight to two thousand
and ten to sever state grant programs so than for some of cyber crimes state
and local law.
Enforcement resources need to be strengthened to attack the low lying
and then of the theft the federal prosecutors failed to go after we heard the last
Congress at a subcommittee hearing about the incident involving Senator Domenici
where some eight hundred dollars in merchandise was charged to a stolen credit card.
We found that the crime was not being prosecuted.
So it seems these are left with the knowledge
that if they don't steal too much they can do so with impunity.
The credit card company will cancel the debt write off the loss and.
There will be no criminal investigation
and so the thieves can keep their bounty of their crimes without worrying about
prosecution.
I believe
that the Secret Service working in partnership with state law enforcement good good
good quickly reverse this expectation that these have in this front.
Forty one seventy five as a comprehensive bill
and not only deals with the need to provide law enforcement.
Notice the law enforcement when innocent. Customer consumers have the data breach.
It is also it also deals with the underlying problems of lack of accountability to
deter crimes from occurring in the first place are privacy
and cyber crimes lag behind both capabilities of our technology
and the sophistication of identity thieves and this legislation will close
that gap
and I'm my pleasure to recognize our new ranking member of the subcommittee the
gentleman from Texas Judge Gomery.
Thank you Chairman Scott thank you to the witnesses.
State to one thirty when it was apparent we were going to be a wild
and ran over the Capitol
but because the hour is so much later I have an opening statement
but I would ask unanimous consent simply dismiss it. For the record.
Let's you all want me to read my opening statement I will
but otherwise will submit that let me just give the last thirty sentences H.R.
Forty one seventy five was introduced by Chairman Conyers writing the.
Smith subcommittee chairman Scott then right. Member. Forbes bipartisan proposal.
I think represents a good first step in tackling the difficult problem the
Democrats absence Abercrombie
and so I will look forward to hearing from the witnesses
and working with my colleagues on this important piece of legislation and with
that. I guess hearing no objection.
Without objection
that statement isn't it in the record thank you is we want to hear from you.
Gentleman from Michigan chairman of the full committee. Thank you.
And as the one that's guilty for holding you up so long.
I will make will not give you my statement.
And put it in the record and add that the privacy.
And cyber crime Enforcement Act is a strong bipartisan measure
that I believe will help combat the growing threat of identity theft
and other cyber crimes this balance bill protects the privacy rights of
consumers the interests of businesses and the legitimate needs of law enforcement.
And I would like to emphasize that.
I look forward to the passage of us cybercrime law
but not at the expense of the substantive issues involved including requiring
much needed notices for security breaches.
I'm aware that the passage of this twenty one sixty eight in the Senate.
But our bill is more comprehensive
and we need to examine it before making hasty decisions
that impact consumers for years to come.
Thank you very much Mr Chairman for your patience
and forbearance Thank thank you Mr Chairman. The gentleman from North Carolina.
That was showing. Our away but least I joined you in Iraq a member
and extending a welcome to our state which Powell.
Thank you
and other members will have the opportunity to include opening statements in the
record at this point I want to thank the witnesses for your patience.
Sometimes because of votes the schedule just goes
and we appreciate your patience in remaining with us.
We have a distinguished panel of witnesses here today.
Help us consider important issues that are before us. The first witnesses.
Andrew Lawrie who is the acting principal deputy assistant attorney general.
And chief of staff for the criminal division at the Department of Justice is
currently serving a detail from the U.S.
Attorney's office from the southern district of Florida where for the past five
years. He served as managing the US managing assistant U.S.
Attorney in the West Palm Beach office.
He served two prior details in the department both as chief of the public integrity
section next witness a special agent in charge of the criminal investigative
investigative division. The United States Secret Service.
He provides guidance in determining the investigative focus of the division which
provides direction to all Secret Service field offices.
Is a twenty year veteran of the Secret Service a native of Columbus Ohio received
his bachelor of arts degree from the University of Maryland
and a master's degree in the field of management from Johns Hopkins University.
Next will be Joe went on the associate director of the division of privacy
and identity protection at the Federal Trade Commission's Bureau of Consumer
Protection Division has a responsibility over consumer privacy
and security issues and then of the theft and credit reporting matters.
Mr Winston is currently serving on the federal government's identity theft task
force which was created by the president in March two thousand and six.
Mr Winston received his undergraduate
and law degrees from the University of Michigan.
Next will be Jamie Knapp executive director of the theft Action Council of Nebraska.
At the council in two thousand
and six she sees me she said she found her she founded the council in two thousand
and six to use her journey as an identity theft victim to help while this council
is a first nonprofit organization dedicated solely to Dennehy theft issues
assisting victims in Nebraska.
She received her bachelor of journalism from the University of Nebraska at Lincoln
next will be Robert Holliman president of the Business Software Alliance with
Solomon as head of the alliance since one thousand nine hundred overseeing
operations in more than eighty five countries is widely known for his work on
policy related issues affecting the technology technology industry including
intellectual property law cyber security international trade
and electronic commerce.
Bachelor of Arts degree in Political Science at Trinity University in Texas.
Doctorate from Louisiana State University Law Center in Baton Rouge
and Lee we have Little League colony associate director of the Electronic Privacy
Information Center in Washington D.C.
She serves as a coordinator for the privacy coalition the privacy coalition has
over forty organizations and affiliates who share a commitment of freedom
and privacy rights.
She's testified before the Department of Homeland Security Department Homeland
Security data privacy
and integrity advisory committee under the domestic surveillance.
Now each of our witnesses written statements will be made part of the record in.
All of the statements in their entirety.
Out as that each witness summarize his or her testimony in five minutes or less
and help you stay within that time there's a timing device on your table
that will start green go to yellow when you have one minute left and then five.
Finally to read when your time has expired.
Will begin with and unfortunately we're expecting a vote any minute now.
So with those bars we can break for a vote and then come right back.
Mr and Mr Laurie. Thank you. Good afternoon.
Chairman Scott ranking member Gohmert
and members of the subcommittee is a pleasure to appear before you today to testify
about the Department of Justice's commitment to combating computer crime
and identity theft
and about the important legislation this subcommittee is considering to address
these threats as information technology increasingly pervades every aspect of our
society the opportunities for criminals to take advantage of it.
Have also increased one result has been the rise of identity theft Department of
Justice is dedicated to aggressively pursuing all forms of cyber crime
and identity theft.
However shortcomings in existing law have at times inhibited its ability to do so.
The privacy and cyber crime Act of two thousand
and seven would address several of the shortcomings
and provide important tools to promote law enforcement efforts.
The Act includes many provisions also recommended in the strategic plan released
earlier this year by the president's identity theft task force the department is
pleased to see the depth of the common ground
that we share on these key issues in particular the department applauds the
amendments in the act that would ensure
that victims receive fair restitution for the time spent to remediate the harm
resulting from identity theft offenses.
Similarly Department supports the provisions of the act
that enhance our ability to prosecute the theft of sensitive information from
computers close loopholes in the cyber extortion statute
and enable us to bring computer crime charges against criminal conspiracies
and organized criminal groups in addition to these many positive aspects the
department would like to provide some suggestions that would strengthen the bill.
First we strongly encourage the committee to consider amending eighteen U.S.C.
Section ten thirty eight five to close a loophole
and appropriately penalize the use of malicious spyware bot nets and key loggers.
Current law criminalizes actions
that cause damage to computers by impairing the integrity or availability of data
or computer systems.
Absent special circumstances however the conduct must cause loss exceeding five
thousand dollars to cause.
To a federal crime many identity thieves obtain personal information by installing
malicious software on numerous individual computers.
Whether
or not the program succeed in stealing information they harm the integrity of the
computer and data.
However it is often difficult
or impossible to measure the loss to each computer owner which approve
that the many small losses together exceed five thousand dollars two amendments
could remedy this situation first Congress could amend Section ten thirty eight
five to make it a misdemeanor offense to damage a protected computer
and cause less than five thousand dollars in loss whether
or not the committee considers that amendment.
We strongly recommend adding a provision to the act
that would make it a federal felony to damage ten or more protected computers.
Regardless of loss.
Let me turn now to section one of two of the bill the provision
that requires victims of major security breaches to provide notice to law
enforcement the bill defines major security breach as a breach
that involves the means of identification pertaining to ten thousand
and more individuals.
This threshold is too high to give the number some context the theft of as few as
one thousand credit card numbers is under the current sentencing guidelines
presumed to involve a minimum loss of five hundred thousand dollars.
We therefore recommend that the threshold for a major security breach be reduced.
The definition should also be amended to include any breach where there may be a
threat to national security
or risk of significant monetary loss without regard to the number of records
affected would also like to mention section one zero six which contains a useful
provision on the forfeiture of the instrumentalities
and proceeds of cybercrime we support the addition of a forfeiture provision we
suggest however that the act explicitly allow for both civil
and criminal forfeiture
and spell out the appropriate procedures language to accomplish these changes
and other technical suggestions to improve the forfeiture procedures is included
with the written testimony of submitted to the subcommittee. In conclusion.
The department would like to emphasize
that law enforcement can continue to fulfill its role in addressing the growing
threat of. Puter crime and identity theft if we have the proper laws
and appropriate resources to privacy and cyber crime Act of two thousand
and seven addresses many of those needs by closing loopholes in existing cybercrime
statutes improving our ability to prosecute criminal groups
and providing much needed resources we believe the act will be an important tool in
the fight against cyber crime. Mr Chairman. This concludes my remarks.
I will be pleased to answer questions from you and other members of the committee.
Thank you Mr Lorry and assume ago. Good afternoon.
Chairman Scott and distinguished members of subcommittee.
I'd like to thank you for the opportunity to address the subcommittee on a subject
of identity crime
and the role of the Secret Service is an investigations by the Secret Service
perhaps the best known for protecting our nation's leaders.
We also investigate a wide array of financial crimes
and work to safeguard our nation's critical financial infrastructure.
With the passage of legislation in one thousand nine hundred four
and one thousand nine hundred six the Secret Service was authorized to investigate
access device fraud
and we were given parallel authority with other law enforcement agencies
and identity crimes and computer fraud cases through our financial
and electronic crime investigations.
The Secret Service has developed particular expertise in the area of identity theft
false identification fraud.
Access device fraud bank fraud and computer fraud in fiscal year two thousand
and seven agents of the Secret Service arrested over four thousand three hundred
suspects for identity theft crimes he suspects are responsible for approximately
six hundred ninety million actual fraud lost to American consumers
and financial institutions the Secret Service has observed a marked increase in
identity theft
and cybercrime criminals continue to seek new methods to compromise victims
personal
and financial information the recent trend observed by law enforcement is the use
of computer
and the Internet to launch cyber attacks targeting citizens financial citizens
and financial institutions cyber criminals have become proficient at stealing
victim's personal information.
The use of phishing e-mails account takeover malicious software hacking attack
and network intrusions result in a data breach.
This stolen information is often sold in bulk quantities to illicit websites on the
Internet. Criminal groups involved in identity theft
and cyber crimes routine the operate in a multicultural stiction environment by
working closely with federal state
and local law enforcement representatives as well as international police agencies.
We're able to provide a comprehensive comprehensive network of intelligence sharing
resource sharing and technical expertise that bridge jurisdictional boundaries.
This partnership approach to law enforcement is vital to our criminal investigative
mission.
The Secret Service has established a national network of financial crimes task
forces and electronic crime task forces and cities across the United States.
These task forces leverage the combined resources of local state
and federal law enforcement partners as well as technical experts from the academic
community
and private industry an organized effort to combat threats to our financial payment
system and critical infrastructure collaboration between law enforcement
and private sector is critical to our preventative approach to identity theft
and cybercrime We also build partners with the academic community to ensure
that law enforcement is on the cutting edge of technology by leveraging research
and development capabilities of teaching institutions in technical colleges the
Secret Service appreciates the subcommittees work to enhance the penalties
and broaden investigative jurisdiction associated with identity theft
and cyber crime. H.R.
Forty one seventy five addresses many of the issues I've discussed today concerning
these offenses H.R.
Forty one seventy five expands the definition of cyber crime requires data brokers
to notify law enforcement authorities of major security breaches
and increases penalties for identity theft and other violations of data privacy
and security. The Secret Service looks forward to working closely with Congress.
As a address identity crime legislation as I've highlighted in my written statement.
The Secret Service has implemented a number of initiatives pertaining to identity
crimes.
We have dedicated enormous resources to increase public awareness provide training
to law enforcement partners
and improve investigative techniques we will continue to aggressively investigate
identity theft offenders to protect consumers the Secret Service is committed to
our mission to safeguard the nation's critical financial infrastructure chairman
Scott This concludes my prepared remarks.
Thank you again for the opportunity to test family have the Secret Service.
Thank you thank you. Mr Ransom.
Thank you Chairman Scott ranking member Gohmert and members of the subcommittee.
I appreciate the opportunity to testify today about these critical issues of
privacy
and identity theft as the Federal Trade Commission's recently issued national
survey shows identity theft continues to afflict millions of Americans every year
with losses in the billions of dollars but beyond these real
and substantial direct costs this crime harms our economic system by threatening
consumer confidence many polls show
that the level of consumer anxiety about identity theft is extremely high the
F.T.C. Plays a lead role in the battle against identity theft.
Through its law enforcement efforts to work on the president cast its extensive
consumer and business education
and its assistance to criminal law enforcement partners.
One way to stop identity theft is to keep sensitive information out of the hands of
thieves by ensuring
that businesses protect the information they collect reports of the latest data
breaches appear almost daily.
And continue to shake Consumer confidence of course not all data breaches
lead to identity but some do causing real damage to affected consumers.
The commission uses its authority under several federal laws to take action against
businesses that fail to reasonably protect sensitive consumer information.
Since two thousand and one the F.T.C.
Has brought fifteen data security cases including our most recent cases announced
this morning against a mortgage company
that through sensitive consumer loan files into publicly accessible dumpsters.
In addition to its enforcement efforts the commission has played a lead role in the
president's identity theft task force a task force strategic plan recommended
thirty one initiatives to reduce the incidence and impact of identity theft.
The recommendations focus on first prevention making it more difficult for
criminals to steal data
or to misuse data they do manage to steal second victim assistance helping
consumers recover from identity theft
and third deterrence strengthening the tools that we have to catch
and punish the criminals.
Most of these thirty one recommendations have been
or are in the process of being implemented with respect to prevention the F.T.C.
Is developed and distributed highly successful business and consumer guidance
and data security
and materials include a very popular data security guide for businesses
which now comes with an online tutorial
and the commission staff will be holding a series of regional data security
seminars across the country beginning next year on the consumer side the commission
launched last year a multimedia campaign titled deter detect defend.
A copy of the package that includes brochures and training camps
and the commission sponsors a multimedia website on guard online which has
information for consumers on basic computer security since its launch this website
has attracted over four point three million visits.
Despite our best efforts to improve data security however there's no foolproof way
to stop all data theft.
For that reason it is critical
that we do whatever we can to make the data less useful for thieves as recommended
by the task force the commission conducted two public workshops this year relating
to the issue of Consumer authentication.
By creating better ways to verify consumers' identities.
When they open new accounts or
when they access existing accounts we can make it more difficult for criminals to
use stolen data regulations recently issued by the F.T.C.
and The federal bank regulatory agencies under the Fact Act provide another tool in
the battle to prevent identity theft these rules require all businesses
that hold consumer account to establish an identity theft prevention program with
regard to Victim Assistance The commission has continued its role as a central
repository for identity theft information between fifteen
and twenty thousand consumers contact us each week for information
and how to guard against identity theft or to obtain help in recovering from it.
Consumers who contact us receive step by step advice at the same time the
information these consumers give us is six entered into our clearinghouse
and is made available to over seven hundred law enforcement agencies for use in law
enforcement.
We are also partnering with other agencies provide training for local law
enforcement across the country and we have developed
and posted a universal police report
that identity theft victims can complete online print
and take to law enforcement for verification with this report victims have access
to a number of rights including the right to place a seven year fraud alert on
their file to summarize identity theft is one of the most important consumer
protection issues of our time
and must be attacked from every angle the commission will continue to place a high
priority on preventing this crime and helping victims to recover.
We look forward to. To continue to work with us in this effort.
I'd be happy to answer any questions you may. Queue.
We have about ten minutes before we have to be on the floor.
So we'll take your testimony and then we'll come back soon as we can.
MS No.
Thank you Chairman Scott and members of the subcommittee.
Thank you for this opportunity to share my story today and for your leadership
and interest in this issue.
My name is Jamie Knapp
and I'm the executive director of the identity theft Action Council of Nebraska a
proud mother of a seven year old and I'm also an identity theft victim.
Today I will speak about my own personal experience
and offer support for the privacy and cybercrime Enforcement Act of two thousand
and seven. But also will provide some additional suggestions on what can be done.
I have regrets in my life and one of them was taking a particular part time job
and handing over my social security number to my employer in May two thousand
and five.
My personal information including my name birth date
and social security number were stolen and used to apply for four credit cards.
The perpetrator turned out to be a manager at my former employer who stole my
information from employer records.
She was arrested in October two thousand and five
and charged with criminal impersonation a felony for stealing my identity.
She served five months in county jail. Only because she couldn't make mail.
And then she was ordered to go to undergo drug treatment for methamphetamine
addiction.
My perpetrator pleaded guilty on the felony charge in October two thousand
and seven
and was ordered to drug court which is a program for nonviolent offenders with
substance abuse problems
and drug court than you at drug court graduation in January two thousand
and eight a total of four felonies will be wiped clean from her criminal record
like they never existed after. Only a year and a half of drug treatment.
I've lost more than a nine digit number from a piece of paper.
This number happens to be the key to my financial past present and future.
Even though no one assigns monetary value to a social security number.
When I became a victim of identity theft I was not prepared for the overwhelming
feeling of helplessness.
And I was stunned at how quickly destruction came
and how easy it was for my perpetrator to open up credit cards.
What I experience was a deep sense of loss including the sense of who I am my
entire core belief system.
Friends who didn't understand what I was going through in a sense of safety.
So worry and uncertainty caused me to change my physical appearance
and intensely watch for strange people or cars following me.
In April two thousand
and six the trauma started to affect my press professional life while working for a
different employer because the original stuff happened in the workplace.
I started to become very uncomfortable
and wasn't able to function at a normal level with my coworkers.
Nor did I feel like I could trust management on my employer.
Shortly thereafter the stress became too much to hide or control.
It started showing itself physically through my inability to sleep
and increased paranoia cloudy vision and forgetfulness in May two thousand
and six I thought counselling
and was officially diagnosed with post-traumatic stress disorder.
I'm not a vote a victim of a violent physical crime
but I certainly feel like someone who is.
My reality is that I will never be in total control over how or
when my social security number will be used for the rest of my life.
I must always have my guard up.
My story does not end with heartache it actually ends with hope.
I had a choice to make I can either forget.
Let this crime ruin my life or create change in the choice was easy.
I founded a nonprofit organization in two thousand
and six called the identity theft Action Council of Nebraska
and we educate consumers about identity theft
and provide victim resources.
I support tougher penalties
and greater victim restitution including It included in this bill
but it would also like to offer a few suggestions criminal penalties
and tools for law enforcement is only part of the solution to more fully address
the problem. Congress should require mandatory notification
when sensitive personal information is breached
and require mandatory data security requirements for business and government
and also provide consumers with affordable easy to use security freeze writes.
This is the first time I've spoken publicly about the depth of my pain with this
crime and I thank you for this opportunity
but my story only really only represents one person out of the millions of
Americans who become victims each year.
I'd like to thank you again for this opportunity
and I'd have be happy to answer any questions.
Thank you Ms Knapp for your very moving testimony. We will.
Vote the three votes pending
and we'll be back as soon as we can Obama be about fifteen minutes.
The committee will come to order the gentleman from California has approved the
starting off without the ranking member.
So the ranking member comes they can blame it on the gentleman from California.
Thank you Mr Holman.
Mr Chairman Mr longer Mr Coble Merz of the subcommittee I want to thank you for the
opportunity to testified today.
There is an urgent need to update our federal criminal laws
and law enforcement needs new tools to find
and prosecute cyber criminals.
Why does the Business Software Alliance care about this issue. Several reasons.
First it hurts our member companies businesses.
Secondly it hurts the development of electronic commerce
and third because it hurts the economy as a whole.
I want to thank you Mr Chairman.
For calling this hearing and for the leadership you have shown
and sponsoring the pending legislation H.R.
Forty one seventy five also to Congress commend Congressman Schiff
and shot Mr longer than others for your leadership in energy introducing H.R.
Twenty two no any earlier this year.
Today's hearing could not come at a better time.
We're in the midst of the holiday series season
and Americans will spend nearly thirty billion dollars in online shopping activity.
They'll be able to shop at thousands of sites compare products services
and get prices
that would have been on available just a few years ago because of the issues
of geography and comparative shopping
that are brought about by the Internet at the same time we know.
Studies show
that many individuals are concerned about their safety about doing business online.
What the risk of criminals are who may be.
Lurking in cyberspace who want to steal their identity.
Their financial records or more. Unfortunately these concerns are fully justified.
The reality is that we use our computers at home in the office in ways today
that were on imaginable the last time there were major revisions in the federal
criminal laws. This is led to a change in the nature of cyber crime
and it's changed the type of criminals. Too big changes have occurred in computing.
First is the sheer growth in the number of people using computers.
The second is the fact that computers are now almost always on
and connected to the Internet.
This is given criminals the opportunity to create malicious code
that can be sent out surreptitiously and can compromise thousands
or hundreds of thousands of computers.
This results in the creation of zombie computers
that the kernel can then remotely control to carry out this hacks the zombies may
not themselves suffer a monetary damage
but they may become part of an unwitting accomplices
and attacking other victims of final two crimes or identity theft
or denial of service.
We also see that cyber crime today is overwhelmingly fueled by profit.
Criminals used to write malicious code for the bragging rights.
Today they do it for the money and that is a change. What can Congress do about it.
We believe
that there is an urgent need to update our criminal laws to get law enforcement
tools they need to a check the changing nature of the threat threat
and the change in crime. We would suggest doing this in five ways.
First target pop nets in ways
that have been identified this morning by criminalizing cyber attacks on ten
or more computers even if they don't suffer five thousand work.
Dollars where the damage is to address new forms of cyber extortion three.
In the coverage of cyber crime laws to conclude computers affecting interstate
commerce fourth attack.
Organized cybercrime by creating an explicit conspiracy to commit cyber crime as an
offense
and fifth strengthen penalties by calling for the forfeiture of computers
and other equipment that are used to conduct crime
and by adopting tougher sentencing guidelines.
Fortunately there is broad congressional law enforcement
and industry support for such legislation.
There are a number of pending bills including two twenty two ninety
that address these issues.
Last month the Senate as adopted as twenty one sixty eight
and finally Mr Chairman your bill does
that with the exception of the provision to target those which we hope will be
added to any final measure. Of course H.R.
Forty one seventy five has many other provisions including data breach notification
and privacy B.S.A.
Understands the seriousness of the problem data breaches represent we are committed
to working with this committee
and what the six other committees who have jurisdiction over this legislation in
data breach to develop a hot copperheads is federal legislation.
But we are very concerned that the inclusion of data preacher privacy
and cyber crime legislation will to lay or prevent an act
and conclusion we are eager to work with this committee.
We believe the time is now and we encourage moving forward in addressing
and closing the loopholes that exist under today cybercrime laws Thank you.
Thank you very much Mr Holman in this county.
Thank you Chairman got ranking member of the Omar
and members of the subcommittee for this opportunity to testify on the bill H.R.
Forty one seventy five that privacy and cybercrime and Forstmann and.
My name is Lily honey I'm associate director at the Electronic Privacy and for.
Mission Center EPIC is a nonprofit Policy Research Center based in Washington D.C.
We focus on privacy civil liberties and constitutional values.
With meet this afternoon is Jonathan David a student at Northeastern law school who
assisted with the preparation of our statement.
Thanks go to the sponsors of the bill.
To a great degree the lack of transparency on data breaches computer system
breaches anomalies
and software failures inhibits the ability of the government to proactively address
computer network vulnerabilities and enforce privacy laws.
The oath saying that what you don't know won't hurt you. Has rarely held true.
And when it relates to data breaches it is never true.
According to the Federal Trade Commission for the seventh year in a row a Dennehy
death is the number one concern of American consumers.
We also know that two hundred
and sixteen million Americans have had their data breaches impact them.
The failings of private actors to manage the Personally Adana flyable information
entrusted to their care justify the passage of H.R. Forty one seventy five.
Further a report from the summit Samuelson clinic confirms
that the private sector is willing
and able to act in putting in place security measures to protect computer networks
that housed personally identifiable information when that data breach.
When data breaches require. Under-staffed statue notification to consumers.
We appreciate that this bill will do what the Privacy Act should have done.
Include private data networks under the comments to protect personally identifiable
information.
This is a key component for privacy protection afford it buy in from fair
information practices that are outlined in the privacy act. The provision.
As of the bill do not preempt state law
but rather create an important federal baseline.
As we have learned the states can respond more quickly than federal government than
the federal government can to emerging privacy challenges.
And it is very important
that the federal government not limit the important work of the states in this area.
The bill creates a great start on defining personally identifiable information
but more needs to be done.
We are now seeing a tremendous increase in the collection of personal information
in the form of biometrics. Behavioral targeting.
Associational information which is completely unregulated.
The challenge for the committee is to create a definition
that recognizes the ever evolving risk data collection poses to privacy.
Epic indorse is the bill language that requires technology protection measures
that render the data elements indecipherable we note
that significant data breaches have occurred because of poor security practices
or circumvention of security measures such as remove all of large quantities of
data records from from office locations on personal portable computer devices
that were subsequently lost or stolen.
Regarding the promulgating of the final privacy impact assessments electronic
records are inclusive things.
It may be very difficult to enforce the intent of the provisions of this statute.
For example.
Epic recently discovered in the midst of our involvement in an agency proceeding
before the Federal Trade Commission regarding the proposed merger merger of Google
and doubleclick that the chair of the F.T.C.
Spouse spouses law firm Jones Day represents one of the parties to the merger.
Upon our making a complaint requesting the recusal of the chair from participation
in the commission's decision making role on the merger requests.
The electronic document disappeared from the Jones Day website this phenomenon of
the disappearing electronic document is not limited to non-government Internet
communications.
It has also been an epic and actions taken by federal government agencies
when publishing documents online.
In closing I would like to thank the subcommittee for this opportunity to speak on
the record regarding these are important measures
that Forth in H R forty one seventy five
and strongly endorsed the efforts to address the issue of data breaches involving
personally identifiable information and efforts of this finances of the D.L.
and The subcommittee to make it more transparent the rule making process related to
privacy impact assessments. Thank you.
Thank you very much for scone and I will now have questions from the members
and I recognize myself for five minutes at this time.
Mr Laurean misread the identity theft penalty
and has been acting included ten million dollars.
Authorized to track down identity thieves.
What have you done with the money.
We have been actively pursuing identity theft cases.
Around the country.
Chairman Scott in the last between zero five
and zero six identity theft cases alone increased about twenty two
or twenty three percent from fifteen hundred and change to nine hundred and change.
Many of those were under the aggravated identity fraud statute those numbers
increased from two hundred twenty six in zero five to five hundred seven in zero
six. In addition there are the Secret Service and the F.B.I.
Have been establishing task forces all over the country.
Joining together with their federal colleagues as well as local law enforcement
and state law enforcement to attack identity crime at a local level
and to ensure that as few of these cases as possible slip through the cracks.
So use you. Putting the ten million to good use. Yes Did you run out of money.
I don't know run out of money but I can get back to you on.
Well if you're tracking down cases with the money do you have enough.
The original in the bill. One of the bills.
That ten million dollars came out of the original bill had one hundred million
and we were told by administration they didn't need any money so
we just left a ten minute. Ten million we got left.
It seems to me that we ought to be a high priority and I think the committee.
Maybe I can speak for the committee
but I'd be willing to put some more authority so
that you could track down what these people would get the idea
that they might get caught.
Have you used up all of the ten million so
that we might consider increasing the authorization. I can't.
As I said I can't tell you whether or not we've used up all the ten million
and I'd be happy to work with the committee and get back to you on that.
OK Now part of the. If you have limited funds you have to make decisions.
The five thousand dollars threshold anybody stealing less than five thousand pretty
much home free. What would it take.
How much would it take to get cases under five thousand also on your target list.
I can't tell you how much it would take.
With respect to money if that's your question for prosecution offices the U.S.
Attorney's offices around the country to lower their thresholds
or if the department would support that I can tell you
that we have used the money
that we have had to create these regional task forces to work together
closely with the state prosecutor's offices and state law enforcement
and to train them in the investigation and prosecution of these sorts of crimes.
And it's the problem with these cases is they are in fact labor intensive because
there's a lot of work that needs to be done and the information is there
but some of it might include when you find out
that somebody with a stolen credit card has ordered something delivered to a post
office box.
You may have to have somebody sit out there until they come to pick it up
and that's you got to pay for that. I mean it's just an hourly rate. So that.
Most and many of these cases can be solved if we just had the resources.
And so we'll work together to find out what resources you may need to lower the
threshold as somebody gets the information they may feel they have they're at risk
of actually getting caught. Now.
Is if if a database is breached is mere possession of the
database across it.
It depends if it's knowing if if a database is breached
and somebody extracts the information then yes if it's not authorized it was an
authorized extraction it is a crime is buying a social security number from some
somebody a crime before you actually without using it.
I.
I don't have the statutes in front of me
but I believe under Title forty four the Social Security statute that
that possession.
If it's with intent to commit fraud would be a crime but mere possession.
If you buy a cell Security number and that's all.
All you've got you don't know what they were going to do with it.
Well it's fairly easy to prove
that somebody who buys somebody else's Social Security number if it's not their own
intends to commit fraud with it but the answer to your question is yes.
If you could not prove that element.
I believe that
that would mean you would not be able to satisfy the statute is fishing a crime.
Fishing fishing is a crime if it violates one of the statutes set
forth in intent thirty.
The elements do need to make it clear that fishing is in fact a crime.
No Germans got I don't think it's necessary to necessarily change the language of
the bill the way you have it now to to indicate that fishing is itself. A crime.
The language that set forth in the bill is adequate to capture.
Those types of scams with the suggestions that we've set forth there today.
Several people have mentioned whether
or not just putting a cookie on somebody's computer where you can extract
information without so-called damaging the computer is
that is that not trespassing or some crime
and authorize placing.
One of those cookies in somebodies computer so that you can get information
and that's some kind of crime. Well.
We What I'd like to do is is is is go back and
and get back to committee on that question. Certainly.
It sounds like a variation of a bot net the way you asked the question
but depending on the way you analyze the statute in the various elements of the
statutes. It's the intent of the of the person who puts it. There is significant.
Is the have heard the suggestion
that you ought to be a crime if you do it to ten computers.
That's any reason why if you do it to one computer why
that also should not be a crime. Well it may very well be a crime.
With in. Under various state statutes.
What we are attempting to do is bring more crimes within the perp.
The federal statute not less will be working together on on
that gentleman from Texas.
Things chairman and again thank you your testimony and appreciate your patience.
Just so I'm clear on the S.A.'s position which tone.
Does B.S.A.
Support a new federal law
that would require businesses to report to notify consumers every time a security
breach occurs.
As Chairman we support the concept of a comprehensive federal data breach bill
that would address the issue of businesses notifying consumers
when there is a significant harm major breach that occurs.
But but my question was not whether we should have a comprehensive bill
that addresses that
but whether you support actually requiring businesses to notify consumers
when the breach is a car but we support.
Notification to consumers.
Under a properly crap the definition of what is significant breaches with other key
components for example one of my colleagues on the panel spoke of the information
is encrypted or red jacket or otherwise stored in a fashion so
that it's not accessible when it's breached.
There shouldn't be a notice we also believe
that there are a number of other important provisions in an overall data security
bill that
that is simply one element of a number of provisions we'd like to say OK Thank you.
And Ms Knapp you're coming forward. Apparently.
We may not even know how many people have actually meant adversely harmed as you
have and you.
You mentioned
that the perpetrator against you was going to have a
record was clean after a year and a half of. Treatment parents.
Let me ask you know there's been laws like in Texas where people have become so
outraged about.
Driving while intoxicated
or driving under the influence been with your State College that.
Are negligent infliction of harm.
Through driving while intoxicated
and people became outraged enough they said let's have a lot.
No more deferred adjudication this is serious enough
that if you commit this then it ought to be on your record for good
and you can't come out from under it. Are you bringing that up or you actually.
Are ging that way
and the possibility at least in the federal realm as far as we can fart
adjudication where. It has to be on someone's record.
I was just referring to my case as it stands
and what is happening to me
but I'm asking you are adversely affected what do you think.
I personally don't think you know something like this.
I think it has to do with identity theft victims in general a lot of times in the
judicial system where we are not seen as a victim of a crime a lot of times
and in my case I don't believe that I was seen as a victim
when the judge at the plea hearing he felt like a restitution hearing one being
needed because how could I possibly have any type of out of pocket costs
and so that you know
that comment to me says I don't see you.
And well obviously the judge didn't understand the crime right.
But it seems to me that as we contemplate this crime
and what is a crime that brings to mind.
Some of the lessons we learned in the last.
Cool about crimes of moral turpitude and.
In society we think those are more serious crimes because they involved a means
rather involved intent Michel are you brought in to in a number of times.
Well a lot depends on the intent.
Well it seems to me that this ought to be one of those crimes
that if you break into somebody's computer if you get their private information
then regardless of what the intent is you know the rights ipsa loquitur out a
basically a black thing speaks for itself.
You know you have the intent and take that intentional aspect out of the proof
that you have to put on. So. I mean think about it involves lying.
It involves fraud involves staffed in some cases like one recently a week
or so ago it involved bar glory Reichian
and put stuff on a computer so you could track what they were doing so I think this
hearing is a great thing
and I do think we need to make this bill as tough as possible so
that America understands how serious the crime is now would just like to ask Ms
Knapp you recommended requiring mandatory notification when dad is breached.
But let me just ask.
Who among the witnesses actually read this bill that we're about here today.
Anybody. Wow all of you.
Well same red lights only with your indulgence
and Chairman I'd like to just asked specifically.
If you could quickly say if you have any specific provisions
that you would like to see changed so we could make note of them
and try to improve the legislation. Mr Lowery starting with you.
And if you've got a good long list there then I'd like the list because we're
looking for ways to make it better and that's what they are and for.
Thank you Congressman. Our recommendation and request would.
To modify section ten thirty eight five regarding damage to computers as we spoke
about before to add language
that would make it a felony if the conduct affected ten or more computers
and also to make it a misdemeanor for damage under five thousand dollars anywhere
between zero and five thousand dollars. We would recommend.
Modifications to Sections ten twenty eight and ten twenty eight.
To define persons to include corporations.
So
that the stealing of the identity of a corporation often used in phishing schemes would
also be a crime under ten twenty eight.
We would also add certain crimes to the less
that would be predicates for the aggravated felony under ten twenty eight
and we provided those papers.
We would ask for a modification to ten thirty eight seven which is the
extortion statute. To enable that statute to reach.
Threats to do.
To release for example to release information
that had already been stolen the way that the statue distracted now.
It covers threats to do damage
but not necessarily threats related to damage already done so we believe the
statute needs a little bit of tweaking there.
We have some suggestions for the for prisoner section.
To include real property
and to change the language in one of the prongs from proceeds to gross proceeds.
And finally and perhaps most significantly.
We request changes or.
Directives to the Sentencing Commission to focus not just on sentences in general
but certain specific which would include.
Defining a victim as not just somebody who suffers monetary loss but.
Who suffers an invasion of privacy and that relates to some of the topics
that have already been discussed at this hearing today.
And in any event it is hard to value. Information stolen.
We finally with respect to the Sentencing Commission.
Would request that they be directed to. Look into.
The aggravating factors that are already there or the enhancements
that are already in the statute
that they be accumulated instead of now applying whether they're the greatest of
is a language that's that's now used.
We would also suggest an enhancement
that the Sentencing Commission look at whether it should be an enhancement for
disclosure of information stolen because it is a separate harm
and in some senses maybe even more significant harm.
Once information is stolen to disclose it. Depending on how many people.
It's disclosed to. So thank you for that I thank you.
And we've got more not or exceed my time
that much if I could ask the witnesses to if you could submit in writing any
suggestions you have for changes to the legislation
that would be greatly appreciated.
And that would include all of you
and including Mr Lowery if you think of anything else but thank you so much.
Thank you. The gentleman from North Carolina.
Thank you as chairman It has been said. We appreciate you all being here.
Mr Tolman I responded to Mr gomers question.
Regarding notifying consumers under a properly crafted statute.
Would you also require support the requirement
that business notify law enforcement the next.
Mr Koppel I appreciate your follow up question on
that I think the yes the answer is we would support the requirement
that businesses notify law enforcement when there is a.
Breach and I think there's probably greater clarity in terms of our support for
that. Again it's with the cabbie odds
that it needs to define what a significant breach is it needs to ensure
that there's not notification if it is unnecessary and we believe that
but the principle we think is worthwhile.
We would hope that that is addressed how are part of a comprehensive data breach.
Thank you sir Mr Winston What steps does the F.T.C.
Take to make sure
that businesses adequately protect personal information from identity theft.
And. We go about this in several ways.
Beginning with law enforcement as I mentioned in my testimony we've brought fifteen
law enforcement cases now against companies
that failed to reasonably protect consumer data in most cases leading to a data
breach. And in addition to law enforcement.
We also do a lot of consumer business education and outreach.
We've published educational materials.
We're going to be holding regional seminars for for businesses so
that they understand what their obligations are
and the understand what the consequences are if they don't meet their obligations.
Thank you for our laws list was didn't require a protection approach to learn from
a should limited to certain industries are certain sectors taken by king
or of the financial financial industries. Yes that's correct.
There are a number of data security laws that apply to different kinds of data
or different kinds of industries.
The financial services industry is one the health care industry is another as part
of the.
Identity theft task force recommendations we have supported a national data security
law that would apply across the board to any business that maintains personal info.
We think that there should be one rule.
Thank you Ms Knapp how can we improve restitution for identity.
Thank you sir for that question.
I think what you're doing with allowing victims to
count their time is very important I think this is the first time
that we have actually seen some of
that because time is so much of what we deal with no fortune never
how does one.
Possibly for one's credit record after having.
That one problem.
In my opinion it is difficult. There are barriers in and.
Things in each person's victim is a sion is different
but the journey is not an easy one.
Thank you note.
For the red line that's very kind gentleman from California.
Mr Long.
Thank you very much Mr Chairman I don't know whether the ranking member needed more
time for his questions. So that's between you and the ranking member.
Thank you for yielding.
Think.
The representative of.
The Justice Department
and also the gentleman representing.
I'm concerned about.
This whole area particularly identity theft and.
We enact legislation I would like to ensure that it actually works.
And one of the things that strikes me on the bill that we have before us is that.
It acts a little differently than some other laws that I'm aware of which is
that when.
The Congress preempt state law it then gives the state A.G.'s
the authority to assist in the enforcement of federal statutes this bill is drafted
as I understand it.
Allows that but does no preemption at all is
that unusual in the law in your experience or is that something
that we see somewhere else.
With respect to our experience I'd be happy to get back to the Committee on another
areas where we've seen this I will note
that in the task force strategic report which is co-chaired by the department
they did recommend that type of preemption.
My concern is.
We are creating a lot of criminalization of activity on a federal level
and yet I wonder whether we have the resources to follow through with it truly
and therefore is this really an attempt to create a federal statute of
criminal sanctions
but with the expectation it will truly be enforced by the states and the feds
and if we're going to do that we ought to know about that
but it seems to me a little different than we've done before and maybe I'm wrong.
Maybe there are other areas of the law and the gentleman from the F.T.C.
Can help me on this.
Mr Laurie said the identity theft task force in some of its recommendations
particularly with regard to look I understand they may have suggested I'm asking is
this a precedent or is this something
that we found another is a law that's what I'm trying to a number of laws
that provide for federal preemption but allow for state attorney general
and Forstmann the Fair Credit Reporting Act as one so that model is.
I think it's not uncommon but where we have no preemption here.
But still extending that.
Well
that I'm not sure about I know there are that's not so I'm trying to figure out if
you could help me in in looking at that and submitting that for the record.
Title two of the legislation.
Authorizes a civil action with.
Civil penalties up to five hundred thousand dollars
or million dollars if it's intentional from any business entity.
Says from any business entity that engages in conduct
that constitute a violation of federal law relating to data security.
If you had a chance to look at the bill.
Do you think that limits it to for profit entities only Or would that be.
Not for profit as well.
How would you look at it from the Justice Department standpoint.
And here is a member of the criminal division so I did not scrub the civil sections
of the bill but we'd be happy to review that and get back to you
and opinions about whether or not it would cover both those types of entities.
I'm trying to sort of figure out where we are here because I want to statute
that works but I also want one that doesn't just sit on the books
and we think it's going to work or frankly if we pass federal laws
that are primarily be enforced by federal authorities to me that's extremely
important. But it's more difficult for us to have oversight.
If what we're doing is passing federal laws that are going to be absolutely if not.
Exclusively are primarily if not exclusively prosecuted at the state level
and I wonder if there are implications with respect to kind of social authority in
that.
The way I read the bill
and I would ask if this seems to make sense because we can certainly change it
looks. Like it provides an across the board maximum penalty of twenty years.
For all violations of Section ten thirty of Title eighteen.
Now unless I missed something that could be interpreted as meaning
that failure to notify breaches. Would carry a harsher penalty for the businesses.
Than for the ID. The eaves themselves.
To me that doesn't sound like a proper priority.
Would you agree with that or is that something that you think makes sense.
I believe the way the bill was was drafted.
It provides for a five year penalty maximum penalty for the failure to notify.
So.
So your answer is that's what you would want rather than the way I thought it was
written. I have a lot more questions but I would like to respect my time limits
and I would yield back.
That's a novel concept of the subcommittee but I thank you gentleman from Ohio.
I thank the chairman for yielding Mr Holman news reports indicate
that crimes committed.
Computers are becoming increasingly prevalent
and I know that's what we've been discussing today with as many as ten million
computers falling victim to hackers. F.B.I.
Director Muller is quoted as saying
that quote bot nets are the weapon of choice for cyber criminals unquote.
How urgent is it that we pass cyber crime legislation
and can we afford to wait on cyber crime legislation while we address other
problems with Internet security.
Thanks for the question I think that it is imperative
and urgent to pass cyber crime legislation. I think there is broad agreement.
In both houses of Congress
and across the aisle in terms of what loopholes need to be closed your question is
correct that the growth and bot nets is enormous problem and
that is bringing law abiding citizens unwittingly into the process in which their
computers are being hijacked and used to perpetrate crime.
It may slow down their computer.
It may be a nuisance for them but they don't really know what's happening
and we should not require that law enforcement be required to show
that there is five thousand dollars with a damage to take action
that case so we believe the problems of media it's growing.
There is a solution and we hope the Congress moves quickly on this. Thank you.
And our legislative efforts enough.
And what can consumers
and businesses do to protect themselves to minimize the threat of cyber crime
legislation is a key part but it's not by itself the sole solution.
There are public awareness activities that are underway through the F.T.C.
and Other agencies to build awareness of this there are private sector efforts
that provide checklists to business owners.
What type of security products they need to deploy and security procedures
and finally there are joint partnerships between industry
and law enforcement the national cyber forensic training Alliance in Pittsburgh is
just such an organization B.S.A.
Supports that as do many in industry they collect data on cyber crime share
that information with law enforcement
and assist in helping with the prosecution so it takes a combined effort of which
legislation is only one component but it's an essential component.
Thank you very much in this chairman as my colleague from North Carolina did I
would be happy to go back in the interest of the rest of the bank
that could be divided between the gentleman from Texas and the gentleman from.
Foreign air but I think I'll just go back grow refer you generally from Texas.
Thank you very much Mr Chairman let me thank you Mr Conyers
and the other co-sponsors for moving forward on what will continue to grow to be
maybe in some minds an insurmountable problem as we become more technological
and the FISC a sheen of the technology that we use becomes more finite certainly.
And more broadly utilized it seems that privacy.
In the midst of innovation is a stepchild and I think
that the Congress has a duty to ensure as the Ninth Amendment.
Instructed us to do to not forget privacy
but also the abuse of too much information identities have
and otherwise with the good comes the bad with benefit comes the burden.
So this will go on as it relates to the potential crime that may come about.
Through the misuse of this technology cybersecurity.
My question would be the ability and the need.
If you will to ensure coordination between all levels of law enforcement.
Even if you're speaking of for example in Houston Texas.
What we call a layered police force.
We have a constable
that has a jurisdiction maybe of seven hundred fifty thousand eight hundred
thousand.
Are those are individuals
that are closer to the constituents they are the ones who do the vixen work
and otherwise. But again they are right there on the ground
and we have sheriffs we have police officers of course we have. The F.B.I.
and Of course the U.S. Secret Service
and just a number of layers so I'd be interested in
that I'd be interested from his county and welcome to get an established for us.
How significant a problem is this whole issue of the invade.
About privacy how give us.
If you will the broadness of the problem
and the depth of the problem if you will
and I have another question let me yield to Mr Magara. Thank you very much.
We partner very well with state
and local law enforcement as well as federal agencies
and we realize the importance of sharing information on different cases
that we are working.
Quite frankly cross the country we have twenty nine different financial crimes task
forces
and twenty four electronic crime task forces those task forces are built on sharing
information not only with law enforcement with private sector as well as the
academic community. I feel the sharing of the information that we have and we do.
Addresses those concerns that you have very well.
And
and in let me just expand a little bit more you in constant communication with local
law enforcement. Maybe I missed it.
Are there task forces that are addressing this question.
Yes on all of our task forces Financial Crimes Task Force.
Well as electronic task forces.
State and local law enforcement are key partners in those task forces so
that information is disseminated through them to back to their department so
that we're coordinating our efforts to address identity theft.
MISKELLY.
Thank you Congresswoman Jackson Lee this is probably the most significant part of
why data breach is even being considered by this committee.
Millions of records of individuals online are available through electronic transfer.
The question is whether it is the victim's responsibility
or whether it is the data Holder's responsibility to manage control of
that information that remember victims are in damage control mode.
They have no idea that they've been attacked until they get notice
when they get notice they can react. Unfortunately notices usually.
Coming because I've gotten they gotten some communication through the mail of
gotten hand looked at their credit report and that's when they know
that someone has appropriated their identity
and literally stolen in their name it takes hundreds of hours sometimes just to
correct that information and the mental and divide and the stress
that comes with
that it's very difficult for people who has not been victimized to even understand.
Those who are and possession of the data.
Have an obligation a moral obligation
and it should be a legal obligation to inform people
when these things occur at the jurisdiction of this committee limits what you can
do in that regard.
You can hold data owner data managers because the data owners are really the people
whose information they're call the control
and make them responsible reporting to a government agency
that agency in turn will port through the Federal Register list of those entities
who have had their data compromised.
I think this is a reasonable approach the numbers of it.
Victims two hundred sixteen million Americans have been impacted by the loss of
data. It's appropriate and definitely is
that in this legislation what you've just recommended.
Yes it is a part that requires those entities that suspect
that their data has been compromised must report to the Secret Service the
compromised
and the Secret Service in turn once a year were published in the Federal Register
list of those entities Thank you Mr Chairman let me just comment
and to highlight section one zero two
that provides criminal penalties for those who don't provide the notice of the
security breach. And finally might I say what we don't have yet.
Which we expect to have in the next couple of years is electronic reporting of
medical records.
Once we add
that large component required to the system bring all medical facilities
and physicians online. We have an Enhanced Opportunity for.
And so I hope this legislation will move through this committee
and move to the floor and have the president's signature I yield back.
Thank you
and I want to thank all of our witnesses for their testimony members may have
additional questions to ask and if so I will submit those to you in writing
and would appreciate if you could respond as soon as possible so the.
Answers can be part of the record without objection the hearing record will remain
open for one week for the submission of additional materials the chairman of the
commercial and Administrative Law Subcommittee has offered a statement.
She has reminded us
that the sum of the parts of the bill come under the jurisdiction of her
subcommittee as well as most of it in this subcommittee
and so she has an interest in this legislation without a gentleman from Texas.
Thank you Mr Chairman I was made aware that there may have been a study
that actually. Deals with how often businesses notify.
Consumers of the breach or loss of data and is that right.
Mr Lowry. It's not a it's not a government study but there has been a study done.
Could you direct us to that information to follow.
Yes I will provide that information and does that study indicate how often.
Criminal activity takes place after a breach.
I don't I don't know if it does the ONLY the only thing I know about the study is
is that.
And again this is not a government study
that we cannot say with any degree of certainty whether it's accurate.
But the only thing I know about the study as I sit here
and will provide to you is that.
They asked
that approximately thirty percent of breaches are reported by victims.
Thank you for that objection Committee stands adjourned.